Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

revocation,trust-record-verify: implement es256 and es384 bundle verification and add EC revocation vectors (#448 items 1, 10)

Closed
  • Is something wrong?
#584 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #590 by @drk-ram — merged

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
python, typescript
Domain
cryptography, documentation, security, testing-qa

Research direction

Start with src/agentrust_trace/revocation.py and trust-record-verify/src/crypto.ts, then trace bundle verification in src/agentrust_trace/revocation.ts and trust-record-verify/src/revocation.ts. Add deterministic ES256/ES384 success and failure vectors via examples/revocation-bundle/gen_revocation_vectors.py, run the revocation and adequacy tests including tests/test_adequacy_all_sets.py, and document fixed-width P1363 encoding in both schema files. Done means both implementations verify valid P-256/P-384 bundles, reject malformed signatures and unsupported algorithms, and the new vectors pass.

Written by the indexing model from the issue text.

Description

What is wrong

Contributor: Raghuvar Durga (@drk-ram)

On main (a7f0858), spec/trace-v0.2.md §3.2.3 and schema/trace-revocation-bundle.json define three signature algorithms for TraceRevocationBundle/1.0:

  • "ed25519"
  • "es256" (ECDSA over P-256 with SHA-256)
  • "es384" (ECDSA over P-384 with SHA-384)

However, as tracked in the Go verifier audit (#448 items 1, 10, and 25):

  1. Both src/agentrust_trace/revocation.py (line 322: if alg != "ed25519": return _unverified("bundle_signature_unsupported", ...)) and trust-record-verify/src/revocation.ts (line 183: if (alg !== "ed25519")) only verify "ed25519" and report lowercase "es256" and "es384" (as well as uppercase "ES256" / "ES384") as bundle_signature_unsupported.
  2. Neither spec/trace-v0.2.md §3.2.3 nor schema/trace-revocation-bundle.json states explicitly that es256 and es384 signatures in sig.value use the fixed-width IEEE P1363 raw r || s encoding (64 bytes for es256, 96 bytes for es384 — the standard JOSE/COSE/WebCrypto JWS format of RFC 7515 §A.3 / RFC 8152 §8.1, rather than ASN.1 DER).
  3. As noted in #448 item 10, examples/revocation-bundle/ has no vector with a validly EC-signed revocation bundle (vectors 21 and 22 use uppercase "ES256" and "ES384" with an Ed25519 key to test bundle_signature_unsupported).

Spec section or file

  • spec/trace-v0.2.md §3.2.3
  • schema/trace-revocation-bundle.json and src/agentrust_trace/schema/trace-revocation-bundle.json
  • src/agentrust_trace/revocation.py
  • trust-record-verify/src/crypto.ts and trust-record-verify/src/revocation.ts
  • examples/revocation-bundle/ (gen_revocation_vectors.py)

Expected behavior

  1. Implement "es256" (kty: "EC", crv: "P-256", 64-byte raw r || s signature with SHA-256) and "es384" (kty: "EC", crv: "P-384", 96-byte raw r || s signature with SHA-384) bundle verification in both:
    • src/agentrust_trace/revocation.py (using cryptography.hazmat.primitives.asymmetric.ec and utils.encode_dss_signature, rejecting non-canonical base64url, wrong byte lengths, out-of-range r/s, and mismatched key curves)
    • trust-record-verify/src/crypto.ts and trust-record-verify/src/revocation.ts (using zero-dependency globalThis.crypto.subtle ECDSA P-256/SHA-256 and P-384/SHA-384, which natively takes IEEE P1363 r || s signatures!).
  2. Keep vectors 21 and 22 (alg: "ES256" and alg: "ES384" uppercase, or an algorithm outside {"ed25519", "es256", "es384"} / mismatched key curve) reporting bundle_signature_unsupported so the two-vector margin for bundle_signature_unsupported in tests/test_adequacy_all_sets.py remains 100% intact, and add new deterministic vectors 29-es256-bundle-verified.json and 30-es384-bundle-verified.json (plus corrupted-signature / statement-revoking EC cases) in examples/revocation-bundle/gen_revocation_vectors.py!
  3. Document in schema/trace-revocation-bundle.json (and its packaged copy) that es256 and es384 sig.value encodings are fixed-width IEEE P1363 r || s (64 bytes for es256, 96 bytes for es384), closing #448 items 1 and 10.

Impact

Enables enterprise KMS/HSM (P-256 / P-384) revocation-bundle verification across both the Python and TypeScript SDKs, adds deterministic EC revocation-bundle conformance vectors, and closes #448 items 1 and 10.

Dominant language
Python
Stars
37
Forks
33
Avg merge
1d 9h
Merged PRs (30d)
121

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentrust-io/trace-spec

All issues in agentrust-io/trace-spec

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.